XaFF-XaFF/CaveCarver

Stars
169
Rank 224,528 (Top 5 %)
Language
C++
License
MIT License
Created over 1 year ago
Updated over 1 year ago

XaFF-XaFF/CaveCarver

XaFF-XaFF

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

CaveCarver - PE backdooring tool which utilizes and automates code cave technique

CaveCarver

Code cave is a technique used to inject additional code or shellcode into an executable without affecting the original functionality of the program. Our Project instruments code cave by adding an additional Section to the PE file where the shellcode resides in. After patching the PEs EntryPoint the control flow gets redirected to the shellcode.

Usage

CaveCarver.exe path_to_exe path_to_shellcode

Cronos-Rootkit

Cronos is Windows 10/11 x64 ring 0 rootkit. Cronos is able to hide processes, protect and elevate them with token manipulation.

Black-Angel-Rootkit

Black Angel is a Windows 11/10 x64 kernel mode rootkit. Rootkit can be loaded with enabled DSE while maintaining its full functionality.

Kernel-Process-Hollowing

Windows x64 kernel mode rootkit process hollowing POC.

Shellcodev

Shellcodev is a tool designed to help and automate the process of shellcode creation.

ZwProcessHollowing

ZwProcessHollowing is a x64 process hollowing project which uses direct systemcalls, dll unhooking and RC4 payload decryption

Cronos-Crypter

Cronos Crypter is an simple example of crypter created for educational purposes.

AMSI-Bypass

Rasta's mouse AMSI patch but with function that makes it undetectable.

MBR-Overwrite-with-custom-message

Overwrite MBR and add own custom message

2Simple-Dll-Injector

C# DLL Injector written as simple as possible

Watykanczyk

Remake znanego wirusa Watykańczyka w C#

Heap-Injection

Example of C# heap injector for x64 and x86 shellcodes

2Simple-Keylogger

Simple keylogger written in C# which is ready for modifications.

WinREPL

WinREPL is a "read-eval-print loop" shell on Windows that is useful for testing/learning x86 and x64 assembly.

Assembler-MessageBox

An Assembly x86 code that shows Windows MessageBox kept as simple as possible.

Discord-Webhook-Cannon

Discord Webhook Cannon is a C# multithreaded, open-source Discord Webhook flooder. It can be used to flood webhooks which are used in malware.